Cybercrime forums play a central role in the cybercrime ecosystem, serving as hubs for the exchange of illicit goods, services, and knowledge. Previous studies have explored the market and social structures of these forums, but less is known about the behavioral dynamics of users, particularly regarding participants' disclosure of criminal activity. This study provides the first large-scale assessment of crime disclosure patterns in a major cybercrime forum, analysing over 3.5 million posts from nearly 300k users. Using a three-level classification scheme (benign, grey, and crime) and a scalable labelling pipeline powered by large language models (LLMs), we measure the level of crime disclosure present in initial posts, analyse how participants switch between levels, and assess how crime disclosure behavior relates to private communications. Our results show that crime disclosure is relatively normative: one quarter of initial posts include explicit crime-related content, and more than one third of users disclose criminal activity at least once in their initial posts. At the same time, most participants show restraint, with over two-thirds posting only benign or grey content and typically escalating disclosure gradually. Grey initial posts are particularly prominent, indicating that many users avoid overt statements and instead anchor their activity in ambiguous content. The study highlights the value of LLM-based text classification and Markov chain modelling for capturing crime disclosure patterns, offering insights for law enforcement efforts aimed at distinguishing benign, grey, and criminal content in cybercrime forums.
Figures & tables
Figure 1. The cumulative sum of initial posts, comments, private messages, and the number of users joining the forum.
Description
2015
2016 (Jan-May)
Newly registered users
480,380
118,705
Users commenting initial posts
232,130
93,529
Users writing private messages (UPM)
23,968
9,042
Users writing initial posts (UIP)
27,003
8,319
Intersection UPM and UIP
12,238
4,027
Private messages
336,559
171,155
Table 1. The Table provides an overview of user activity on the forum.
Figure 2. Overview of the processing steps of our methodology, starting with four preprocessing steps followed by three analysis methods.
Initial Post
Label
Please, I’m working into colors and edition in Photoshop CC 2015. Need some feedbacks, I’ll post the before and after! I’m trying to do it faster , so it’s not anything especial or professional.[…] BEFORE: CLICK HEREAFTER: CLICK HERE […] The quality is bad due to image res.
benign
So here’s an off-topic question, what’s your favorite movie or movie’s? I personally like the new Jurassic World, Zombie-land, and the R.E.D series.What about you?
benign
_URL_This is only really useful for Origin accounts as there are no accounts for the other sections.
grey
A· Inactive means inactive for 3+ months [..] NO PERSONAL ACCOUNTS- Only EUNE Accounts […] Only level 30 accounts with 60+ Champions Contact me via PM giving full info of the accounts
grey
I got this source code for a java rat and idk how to compile it to use it can someone help?
crime-related
hey guys :) That’s my share : ALL VERIFIED, CRACKED ACCOUNT URL +rep if you want more :)
crime- related
Table 2. The Table shows examples of initial posts for the disclosure labels, benign, grey, and crime-related. Some characters have been removed for better readability.
Mean (std)
Median
Variable
C1
C2
C1
C2
MWU Stat
active weeks
1.35 (0.98)
6.09 (5.70)
1.0
4.0
4.80⋅106 ***
max inactive weeks
0.54 (1.66)
16.56 (9.24)
0.0
15.0
1.32⋅106 ***
crime ip count
0.59 (1.34)
4.53 (10.23)
0.0
2.0
2.00⋅107 ***
grey ip count
0.90 (1.61)
7.59 (14.78)
0.0
3.0
1.51⋅107 ***
benign ip count
0.92 (1.71)
2.90 (6.86)
1.0
1.0
3.19⋅107 ***
Table 3. The table presents descriptive statistics for the variables underlying the two user clusters, Cluster 1 (C1) and Cluster 2 (C2). Reported measures include the mean, standard deviation, and median, along with the Mann–Whitney U test results and their statistical significance (***).
Label
# Initial Posts
# Comments to initial posts
Mean # comments per thread
Grey
49,278 (40.71%)
1,394,872 (41.37%)
32.86 (149.91)
Benign
36,328 (30.01%)
342,047 (10.14%)
12.08 (40.23)
Crime-related
30,944 (25.57%)
1,581,104 (46.90%)
58.00 (455.03)
Unclear
4,481 (3.70%)
53,405 (1.58%)
15.23 (46.85)
Table 4. Overview of the Crime Disclosure Labelling. The comments to a thread (initial post) have the same label as the initial post. The value in the brackets shows the corresponding percentage or standard deviation (last column on the right).
Figure 3. Diagram showing the the number of users who write initial posts per disclosure label and the overlap between users who write initial posts with different crime disclosure levels.
Figure 4. Markov chain visualization for Cluster 1. Circles represent disclosure levels of initial posts, while arrows indicate transition probabilities between levels.
Figure 5. Markov chain visualization for Cluster 2. Circles represent disclosure levels of initial posts, while arrows indicate transition probabilities between levels.
Variable
Estimate
Std. Error
OR
95% CI
Intercept
−2.45 ***
0.10
0.09
[0.07,0.11]
UnclearPosts
−0.04
0.06
0.96
[0.86,1.08]
GreyPosts
1.30 ***
0.03
3.68
[3.50,3.86]
BenignPosts
0.35 ***
0.02
1.42
[1.35,1.49]
CrimePosts
0.97 ***
0.03
2.64
[2.50,2.79]
Cluster 1
0.81 ***
0.07
2.25
[1.98,2.56]
Table 5. Results of the logistic regression model examining the likelihood of sending a private message (0 = no, 1 = yes). Among users who wrote an initial post (n = 33,127), 46% (n = 15,267) wrote at least one private message. The model has a RMcF2 of 0.164 .
Benign-dom. users n=3774
Crime-dom. users n=4664
Grey-dom. users n=7069
Benign-dom. users
0.23
0.27
0.50
Crime-dom. users
0.14
0.34
0.51
Grey-dom. users
0.12
0.25
0.63
Table 6. Matrix displaying the results of the assortative mixing analysis linking private-messaging ties to dominant public crime-disclosure profiles. Rows and columns represent users who predominantly write initial posts at each specific disclosure level.
Feb 16, 2026·Benoît Dupont, Chad Whelan, Serge-Olivier PaquetteCybersecurity
International Centre for Comparative Criminology, Université de Montréal, Canada · Deakin Centre for Cyber Research and Innovation, Deakin University, Australia · Flare Systems, Canada